Remote device control method, device, electronic device and medium

Abstract

The present invention relates to data security technology, and discloses a remote device control method, including: receiving encryption parameters input by a user, generating a key according to the encryption parameters, obtaining a shared key set, negotiating a shared key with a remote device to be controlled by sending the shared key set, and after the remote device to be controlled is registered on a preset cloud service platform, online monitoring is performed on the registered and bound remote device to be controlled, and remote control is performed on the online remote device to be controlled based on the negotiated shared key. The present invention also proposes a remote device control device, an electronic device, and a computer-readable storage medium. The present invention can improve the security of information transmission during remote control of a remote device.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a remote device control method, device, electronic device and computer-readable storage medium. Background Art

[0002] With the popularization of concepts such as remote control, smart medical care, and smart home, the concept of remote device control has developed rapidly. The Internet can be used to control remote devices to solve problems such as long geographical spans, uneven distribution of medical resources, and improve living comfort.

[0003] In the prior art, remote device control has the following defects: 1. It is implemented using dedicated lines, which is expensive, has low utilization rate, and low cost performance; 2. Communication transmission data is not encrypted, only the channel is encrypted, which is vulnerable to man-in-the-middle attacks, such as replay attacks; 3. The cloud service platform plays an important role. Once the cloud service platform is attacked, it is easy to affect the operation process of the remote device.

[0004] Therefore, there is an urgent need for a secure remote device control method. Summary of the invention

[0005] The present invention provides a remote device control method, device and computer-readable storage medium, the main purpose of which is to improve the security of information transmission during the remote control of the remote device.

[0006] To achieve the above object, the present invention provides a remote device control method, comprising:

[0007] Receiving encryption parameters input by a user, generating a key according to the encryption parameters, obtaining a shared key set, and performing shared key negotiation with a remote device to be controlled by sending the shared key set;

[0008] After the remote device to be controlled is registered on the preset cloud service platform, online monitoring is performed on the registered and bound remote device to be controlled;

[0009] The online remote device to be controlled is remotely controlled based on the negotiated shared key.

[0010] Optionally, the encryption parameters include a symmetric cryptographic algorithm, an encryption mode, a first Hash function, a shared key generation algorithm, and an encryption password, and the generating of keys according to the encryption parameters to obtain a shared key set includes:

[0011] Generate a shared key using the shared key generation algorithm and the encryption password;

[0012] Generate a first negotiated random number, and perform hash processing on the first negotiated random number based on the first hash function to obtain a first negotiated hash value;

[0013] Encrypting the shared key and the first negotiated random number using the symmetric encryption algorithm to obtain an encryption key;

[0014] Generate a first negotiation timestamp, summarize the symmetric encryption algorithm, the encryption mode, the first hash function, the first negotiation timestamp, the shared key, the encryption key and the first negotiated hash value, and obtain the shared key set.

[0015] Optionally, performing shared key negotiation with the remote device to be controlled by sending the shared key set includes:

[0016] Sending the shared key set to the remote device to be controlled;

[0017] Receive a second negotiation timestamp, a second negotiation hash value, and a verification key fed back by the remote device to be controlled based on the shared key set;

[0018] Performing random number verification and timestamp verification on the second negotiation timestamp, the second negotiation hash value and the verification key;

[0019] When both the random number verification and the timestamp verification are passed, it is confirmed that the shared key negotiation with the remote device to be controlled is completed.

[0020] Optionally, before online monitoring of the registered and bound remote device to be controlled, the method further includes:

[0021] Receiving first terminal information input by a user, performing hash processing on the first terminal information, and sending the hashed first terminal information to an account server in the cloud service platform;

[0022] Receiving terminal verification information fed back by the account server, wherein the terminal verification information is obtained by the account server verifying the hashed first terminal information with the hashed first device information obtained from the remote device to be controlled;

[0023] Performing terminal verification on the terminal verification information and the first terminal information, and when the terminal verification succeeds, sending second terminal information to the account server;

[0024] Receive a registration result fed back by the account server based on the second terminal information and the second device information sent by the remote device to be controlled.

[0025] Optionally, the remotely controlling the online remote device to be controlled based on the negotiated shared key includes:

[0026] When receiving the device online confirmation information sent by the account server, performing two-way authentication with the remote device to be controlled;

[0027] When the two-way authentication is completed, the sent control information is encrypted using the negotiated shared key to obtain encrypted control information;

[0028] The encrypted control information is sent to the remote device to be controlled, so that the remote device to be controlled decrypts the encrypted control information and executes the decrypted control command.

[0029] Optionally, performing two-way authentication with the remote device to be controlled includes:

[0030] Perform multiple rounds of random number verification and multiple rounds of timestamp verification with the account server and the remote device to be controlled;

[0031] After the multiple rounds of random number verification and the multiple rounds of timestamp verification are passed, a transit connection is established with the remote device to be controlled through a pre-built transit server;

[0032] When it is detected that the account server receives the connection confirmation message sent by the transit server, the connection confirmation message sent by the device control terminal, and the connection confirmation message sent by the remote device to be controlled, it is determined that the two-way authentication is completed.

[0033] Optionally, the online monitoring of the remote device to be controlled after registration and binding includes:

[0034] The remote device to be controlled is monitored online through the remote device IP recorded in the account server.

[0035] In order to solve the above problems, the present invention further provides a remote device control device, the device comprising:

[0036] A shared key negotiation module, used to receive encryption parameters input by a user, generate a key according to the encryption parameters, obtain a shared key set, and perform shared key negotiation with a remote device to be controlled by sending the shared key set;

[0037] The device online monitoring module is used to perform online monitoring on the remote device to be controlled after the remote device to be controlled is registered and bound on the preset cloud service platform;

[0038] The remote device control module is used to remotely control the online remote device to be controlled based on the negotiated shared key.

[0039] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0040] a memory storing at least one instruction; and

[0041] The processor executes the instructions stored in the memory to implement the remote device control method described above.

[0042] In order to solve the above problem, the present invention further provides a computer-readable storage medium, wherein at least one instruction is stored in the computer-readable storage medium, and the at least one instruction is executed by a processor in an electronic device to implement the above-mentioned remote device control method.

[0043] The present invention generates a key for the encryption parameters input by the user through the device control terminal to obtain a shared key set. Based on the shared key set, the device control terminal and the remote device to be controlled are negotiated for a shared key. In addition, the negotiated shared key is used for encryption in the registration and binding stage of the remote device to be controlled and the remote device control stage, thereby improving the security of remote device registration and the confidentiality of control information transmission of the remote device. At the same time, when the remote device to be controlled is registered and bound, it can be deployed using the existing public network, thereby improving the utilization rate of the network, and the preset cloud service platform only registers and binds the device control terminal and the remote device to be controlled, and does not know the negotiated shared key, thereby weakening the authority of the cloud service platform, ensuring that the communication content of the two parties cannot be stolen through the cloud service platform, and further improving the security of control information transmission when controlling the remote device. Therefore, the remote device control method, device, electronic device and computer-readable storage medium proposed in the present invention can improve the security of information transmission during remote control of remote devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of a flow chart of a remote device control method provided by an embodiment of the present invention;

[0045] Figure 2 A functional module diagram of a remote device control device provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of the structure of an electronic device for implementing the remote device control method provided by an embodiment of the present invention.

[0047] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0049] The embodiment of the present application provides a remote device control method. The execution subject of the remote device control method includes but is not limited to at least one of the electronic devices such as a server, a terminal, etc. that can be configured to execute the method provided by the embodiment of the present application. In other words, the remote device control method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc.

[0050] Reference Figure 1 FIG. 1 is a flow chart of a remote device control method provided by an embodiment of the present invention. In this embodiment, the remote device control method includes:

[0051] S1. The device control terminal receives encryption parameters input by a user, generates a key according to the encryption parameters, obtains a shared key set, and performs shared key negotiation with the remote device to be controlled by sending the shared key set.

[0052] In the embodiment of the present invention, the device control terminal may be a mobile phone, a tablet or a computer. The remote device to be controlled refers to an electronic device that can be remotely controlled and remotely operated by wireless or electrical signals through Internet access and other means, and is mainly used for remote monitoring, remote service, remote diagnosis, etc. At the same time, by setting a shared key, the confidentiality and integrity of data transmission between the two communicating parties can be greatly improved.

[0053] Specifically, the encryption parameters include a symmetric encryption algorithm, an encryption mode, a first hash function, a shared key generation algorithm and an encryption password, and the device control terminal generates a key for the encryption parameters to obtain a shared key set, including:

[0054] The device control terminal generates a shared key using the shared key generation algorithm and the encryption password;

[0055] The device control terminal generates a first negotiated random number, and performs hash processing on the first negotiated random number based on the first hash function to obtain a first negotiated hash value;

[0056] The device control terminal encrypts the shared key and the first negotiated random number using the symmetric encryption algorithm to obtain an encryption key;

[0057] The device control terminal generates a first negotiation timestamp, summarizes the symmetric encryption algorithm, the encryption mode, the first hash function, the first negotiation timestamp, the shared key, the encryption key and the first negotiation hash value, and obtains the shared key set.

[0058] In an optional embodiment of the present invention, the precondition is that the device control terminal and the remote device to be controlled are in the same local area network or are directly physically connected, which can effectively improve the effectiveness of the shared key negotiation.

[0059] In the embodiment of the present invention, the user inputs the symmetric cryptographic algorithm E, the encryption mode M, the first hash function H, the shared key generation algorithm EK, and the encryption password P in the device control terminal, generates the shared key K=EK(P) using the shared key generation algorithm, and generates the first negotiated random number num, encrypts the shared key K and the first negotiated random number num using the symmetric cryptographic algorithm E to obtain the encrypted shared key E(K,num), and hashes the first negotiated random number num using the first hash function H to obtain the first negotiated hash value H(num). At the same time, the shared key set finally generated includes a timestamp, a Nonce (one-time random number) value, etc., which can effectively resist replay attacks and further improve the security of data transmission.

[0060] In detail, the device control terminal performs shared key negotiation with the remote device to be controlled by sending the shared key set, including:

[0061] The device control terminal sends the shared key set to the remote device to be controlled;

[0062] The device control terminal receives a second negotiation timestamp, a second negotiation hash value and a verification key fed back by the remote device to be controlled based on the shared key set;

[0063] The device control terminal performs random number verification and timestamp verification on the second negotiation timestamp, the second negotiation hash value and the verification key;

[0064] When both the random number verification and the timestamp verification are passed, the device control terminal confirms completion of the shared key negotiation with the remote device to be controlled.

[0065] In an optional embodiment of the present invention, when the remote device to be controlled receives the shared key set, it decrypts the encrypted shared key E(K, num), obtains the decrypted random number and performs hash processing, verifies whether it is consistent with the received first negotiated hash value H(num), and when the verification is consistent, verifies whether the first negotiated timestamp T is more than 60s compared with the current time. If it is not more than 60s, it indicates that the timestamp is not invalid, and it is determined that the timestamp verification is successful.

[0066] In an optional embodiment of the present invention, the remote device to be controlled sends a second negotiated timestamp T1, a second negotiated hash value H(num1) and the verification key E(K, num+num1) to the device control terminal, wherein + represents an exclusive OR operation. The steps of performing random number verification and timestamp verification on the second negotiated timestamp, the second negotiated hash value and the verification key by the device control terminal are similar to the steps of verifying the first negotiated hash value and the first negotiated timestamp, and are not repeated here.

[0067] At the same time, when both the random number verification and the timestamp verification are passed, the device control terminal sends a command Command to close the password modification service, that is, E(K, Command) and the second negotiated timestamp T2 are sent to the remote device to be controlled. After receiving the message, the remote device to be controlled closes the password modification service and sends OK to the control software of the remote device to be controlled. After receiving OK, the control software of the remote device to be controlled tries to modify the password again. If there is no response, the service is terminated. If the remote device to be controlled has return information, the status of the remote device to be controlled is checked, the password is modified and the password modification service is closed.

[0068] S2. After the remote device to be controlled is registered on the preset cloud service platform, the device control terminal performs online monitoring on the registered and bound remote device to be controlled.

[0069] In the embodiment of the present invention, in view of the high cost of building a private network, low utilization rate, and low cost performance, the present invention adopts the use of the existing public network to operate and control remote devices, which can not only save costs, but also can be used at any time, which is more convenient. In addition, in order to weaken the role authority of the cloud service platform and reduce the impact of attacks on the cloud service platform, the present invention sets the cloud service platform only as an account server and a transit server, wherein the account server mainly stores the user ID and the correspondence between the remote device M, and the transit server is mainly used for the device control terminal and the remote device to perform NAT transmission connection. At the same time, the cloud service platform does not know the shared key K used by the device control terminal to communicate with the remote device, so it can ensure that the communication content of both parties cannot be stolen through the cloud platform, greatly improving security.

[0070] In detail, before the device control terminal performs online monitoring on the registered and bound remote device to be controlled, the method further includes:

[0071] The device control terminal receives the first terminal information input by the user, performs hash processing on the first terminal information, and sends the hashed first terminal information to the account server in the cloud service platform;

[0072] The device control terminal receives the terminal verification information fed back by the account server, wherein the terminal verification information is obtained by the account server verifying the first terminal information after hash processing with the first device information after hash processing obtained from the remote device to be controlled;

[0073] The device control terminal performs terminal verification on the terminal verification information and the first terminal information, and when the terminal verification succeeds, sends second terminal information to the account server;

[0074] The device control terminal receives a registration result fed back by the account server based on the second terminal information and the second device information sent by the remote device to be controlled.

[0075] In an optional embodiment of the present invention, the remote device adding request includes a registration account ID, a registration password P1, a device name Device of the remote device to be controlled. The first verification information includes a second hash function H1, H1(ID), H1(Device) and a first registration random number Num1.

[0076] In an optional embodiment of the present invention, for example, the device control terminal, the account server and the remote device to be controlled are registered and bound using the following steps:

[0077] Step A, the device control terminal receives the first terminal information input by the user: device name Device, account server IP, first registration random number Num1, second hash function H1, the device control terminal generates a first registration timestamp T1, a second registration random number Num2, and then sends the first registration timestamp T1, H1(num1), H1(ID), H1(Device), H(ID+Device), E(K,num2) and H(num2) to the account server;

[0078] Step B, the remote device to be controlled receives the first device information input by the user: the registered account ID, the account server IP, the first registered random number Num1, and the second hash function H1, and the remote device to be controlled generates a second registration timestamp T2 and a third registration random number Num3, and then sends the second registration timestamp T2, H1(num1), H1(ID), H1(Device), H(ID+Device), E(K,num3), and H(num3) to the account server;

[0079] Step C. When the account server receives the messages of step A and step B, it verifies whether H1(num1), H1(ID), H1(Device), and H(ID+Device) are consistent. After verification, it sends terminal verification information to the device control terminal: the third registration timestamp T3, the fourth registration random number Num4, H1(T1), H1(num4+T1), H1(ID), H1(Device), H(ID+Device), E(K,num3), and H(num3); and sends device verification information to the remote device to be controlled: the third registration timestamp T3, the fourth registration random number Num4, H1(T2), H1(num4+T2), H1(ID), H1(Device), H(ID+Device), E(K,num2), and H(num2).

[0080] Step D, the device control terminal receives the information of step C, verifies whether the received H1(T1), H1(ID), H1(Device), H(ID+Device) are consistent with those sent in step A, and calculates H1(num4+T1), verifies whether it is consistent with that received in step C. After successful verification, the second terminal information is sent to the account server: the fourth registration timestamp T4, H1(T3), H1(num4+T3), H1(ID), H1(Device), H(ID+Device), E(K,num2+num3), H(num2+num3);

[0081] Step E: The remote device to be controlled receives the information of step C, verifies whether the received H1(T2), H1(ID), H1(Device), H(ID+Device) are consistent with those sent in step B, and calculates H1(num4+T2) to verify whether it is consistent with that received in step C. After successful verification, the second device information is sent to the account server: the fifth registration timestamp T5, H1(T3), H1(num4+T3), H1(ID), H1(Device), H(ID+Device), E(K,num2+num3), H(num2+num3);

[0082] Step F. After receiving the information from step D and step E, the account server verifies whether H1(T3), H1(num4+T3), H1(ID), H1(Device), H(ID+Device), E(K,num2+num3), and H(num2+num3) in step D and step E are consistent. After verification, the user ID is bound to the remote device to be controlled, and then OK is sent to the remote device to be controlled and the device control terminal respectively. After the remote device to be controlled and the device control terminal receive OK, the service is terminated and the registration and binding is successful.

[0083] In the embodiment of the present invention, for security reasons, the remote device is generally deployed in the intranet and has no public IP address. Therefore, the account server, the device control terminal and the user cannot directly find the remote device through the IP address (generally a private address) of the remote device, nor can they determine whether it is online. The present invention uses heartbeat detection, that is, the remote device periodically sends an online signal to the account server to inform it that it is online.

[0084] In detail, the device control terminal performs online monitoring on the remote device to be controlled after registration and binding, including:

[0085] The device control terminal performs online monitoring of the remote device to be controlled through the remote device IP recorded in the account server.

[0086] In an optional embodiment of the present invention, the remote device to be controlled generates a detection timestamp Ti and sends heartbeat monitoring information to the account server: detection timestamp Ti, H1(Ti+1), H1(ID), H1(Device), H(ID+Device); the account server verifies that the bound device account is correct by checking whether there is a bound device account that satisfies H1(ID), H1(Device), H(ID+Device), and then displays that the remote device to be controlled is online, records the IP, and sends an OK message to the remote device to be controlled. The device control terminal performs online monitoring of the remote device to be controlled through the remote device IP recorded in the account server.

[0087] In another optional embodiment of the present invention, after the remote device to be controlled receives OK, it will wait for the next cycle to send heartbeat monitoring information. If no OK message is received, it will continue to send heartbeat monitoring information. When the number of times the OK message is not received exceeds a preset threshold, an alarm will be issued.

[0088] S3. The device control terminal remotely controls the online remote device to be controlled based on the negotiated shared key.

[0089] In an embodiment of the present invention, the control information sent by the device control terminal is encrypted and transmitted based on the negotiated shared key. Due to the confidentiality of the shared key, it can effectively resist control information leakage and replay attacks, thereby greatly reducing the risk of remote devices being attacked and improving the security of remote device use.

[0090] In another optional embodiment of the present invention, before the device control terminal remotely controls the online remote device to be controlled based on the negotiated shared key, the method further includes:

[0091] The device control terminal verifies through the account server whether the remote device to be controlled selected by the user is online;

[0092] If the remote device to be controlled selected by the user is not online, the device control terminal sends an alarm message;

[0093] If the remote device to be controlled selected by the user is online, the device control terminal receives the device online confirmation information sent by the account server.

[0094] In an embodiment of the present invention, a user logs in to an account server and selects the name of a device to be controlled. The account server performs online verification. If the device does not exist or is not online, an alarm notification is sent to the device control terminal. If the device is online, an OK message is sent to the device control terminal.

[0095] In detail, the device control terminal remotely controls the online remote device to be controlled based on the negotiated shared key, including:

[0096] When the device control terminal receives the device online confirmation information sent by the account server, the device control terminal performs two-way authentication with the remote device to be controlled;

[0097] When the two-way authentication is completed, the device control terminal encrypts the sent control information using the negotiated shared key to obtain encrypted control information;

[0098] The device control terminal sends the encrypted control information to the remote device to be controlled, so that the remote device to be controlled decrypts the encrypted control information and executes the decrypted control command.

[0099] In detail, the device control terminal performs two-way authentication with the remote device to be controlled, including:

[0100] The device control terminal performs multiple rounds of random number verification and multiple rounds of timestamp verification with the remote device to be controlled through the account server;

[0101] After the multiple rounds of random number verification and the multiple rounds of timestamp verification are passed, the device control terminal is connected to the remote device to be controlled through a pre-built transit server;

[0102] When the device control terminal detects that the account server receives the confirmation connection message sent by the transit server, the confirmation connection message sent by the device control terminal and the confirmation connection message sent by the remote device to be controlled, it is determined that the two-way authentication is completed.

[0103] In an optional embodiment of the present invention, the two-way authentication between the device control terminal and the remote device to be controlled can be achieved by the following steps:

[0104] Step 1, the device control terminal generates an authentication timestamp t1 and a random number NUM1, and sends the authentication timestamp t1, H1(T0), H1(ID), H1(Device), H(ID+Device), E(K, NUM1), and H(NUM1) to the account server, where T0 is the timestamp when the device is detected to be online;

[0105] Step 2: After receiving the message in step 1, the account server verifies whether the device and account binding information satisfy H1(T0), H1(ID), H1(Device), H(ID+Device). After successful verification, it sends the authentication timestamps t2, H1(t1), H1(ID), H1(Device), H(ID+Device), E(K,NUM1), H(NUM1) to the remote device to be controlled.

[0106] Step 3: The remote device to be controlled receives the message in step 2, verifies whether the received H1(ID), H1(Device), and H(ID+Device) match, and decrypts E(K,NUM1) to calculate H(NUM1), and verifies whether it is consistent with the message received in step 2. After successful verification, it generates the authentication timestamp t3 and random number NUM2, and sends t3, H1(t2), H1(ID), H1(Device), H(ID+Device), E(K,NUM1+NUM2), and H(NUM2+H1(t1)) to the account server;

[0107] Step 4. The account server receives the message from step 3 and verifies whether H1(t2), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it sends authentication timestamps t4, H1(t3), H1(ID), H1(Device), H(ID+Device), E(K, NUM1+NUM2), and H(NUM2+H1(t1)) to the device control terminal; and sends authentication timestamps t4, H1(t3), H1(ID), H1(Device), and H(ID+Device) to the remote device to be controlled;

[0108] Step 5. The device control terminal receives the message of step 4, verifies whether H1(ID), H1(Device), and H(ID+Device) are consistent, and decrypts E(K, NUM1+NUM2) to calculate H(NUM2+H1(t1)), and verifies whether it is consistent with that received in step 4. After successful verification, the authentication timestamp t5, H1(t4), H1(ID), H1(Device), H(ID+Device), and H(E(K, t4)+E(K, NUM1+H1(t3))+E(K, NUM2+H1(t1))) are sent to the account server; the remote device to be controlled sends the authentication timestamp t6, H1(t4), H1(ID), H1(Device), H(ID+Device), and H(E(K, t4)+E(K, NUM1+H1(t3))+E(K, NUM2+H1(t1))) to the account server;

[0109] Step 6. The account server verifies whether H1(t4), H1(ID), H1(Device), H(ID+Device), and H(E(K, t4)+E(K, NUM1+H1(t3))+E(K, NUM2+H1(t1))) sent by both parties in step 5 are consistent. After verifying H1(t4), the account server generates an authentication timestamp t7 and a random number NUM3, selects a transit server IP and a forwarding port Port, and sends t7, NUM3, H1(ID), H1(Device), H(ID+Device), hash function H2, transit server IP and Port to the device control terminal and the remote device to be controlled respectively; and sends t7, NUM3, H1(ID), H1(Device), H(ID+Device), hash function H2 and forwarding Port to the transit server;

[0110] Step 7: After receiving the message in step 6, the transit server stores NUM3, H1(ID), H1(Device), H(ID+Device), opens the forwarding port and service, and sends an OK message to the account server;

[0111] Step 8: After receiving the message in step 6, the device control terminal and the remote device to be controlled confirm that they can connect to the transit server and then send an OK message to the account server. After the account server receives the OK message from all three parties, the authentication process ends.

[0112] In an optional embodiment of the present invention, after the device control terminal and the remote device to be controlled obtain the IP and forwarding port of the transit server, a shared key is used to perform the control information encryption transmission stage. The specific steps are as follows:

[0113] a. The device control terminal generates a timestamp t8 and a random number NUM4, and sends t8, H2(NUM3), H1(ID), H1(Device), H(ID+Device), H2(E(K,NUM3)), E(K,NUM4), and H(NUM4) to the relay server.

[0114] b. The remote device to be controlled generates a timestamp t9 and a random number NUM5, and sends t9, H2(NUM3), H1(ID), H1(Device), H(ID+Device), H2(E(K,NUM3)), E(K,NUM5), and H(NUM5) to the relay server.

[0115] c. After receiving messages a and b, the relay server verifies whether H2(NUM3), H1(ID), H1(Device), H(ID+Device), and H2(E(K,NUM3)) are consistent. After successful verification, it sends OK to the device control terminal to indicate that the command can be sent, and sends t10, H2(t8), H1(ID), H1(Device), H(ID+Device), E(K,NUM5), and H(NUM5); it sends OK to the remote device to be controlled to indicate that the command is ready to be sent, and sends t10, H2(t9), H1(ID), H1(Device), H(ID+Device), E(K,NUM4), and H(NUM4).

[0116] d. After receiving message c, the remote device to be controlled verifies whether H2(t8), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t11 and sends t11, H2(t10), H1(ID), H1(Device), and H(ID+Device) to the relay server, indicating that it is waiting to receive a command.

[0117] e. After receiving OK, the device control terminal generates timestamp t12, intends to execute command Command1, and sends t12, H2(t10), H1(ID), H1(Device), H(ID+Device), and E(K, Command1+NUM4+NUM5) to the transit server.

[0118] f. After receiving messages d and e, the relay server verifies whether H2(t10), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t13 and sends t13, H2(t12), H1(ID), H1(Device), H(ID+Device), and E(K, Command1+NUM4+NUM5) to the remote device to be controlled; after the transmission is completed, it sends OK to the device control terminal to indicate that the command has been sent successfully, and sends t13, H2(t11), H1(ID), H1(Device), and H(ID+Device).

[0119] g. The device control terminal receives message f and verifies whether H2(t11), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates timestamp t14, sends OK to the relay server to indicate that it is waiting for the command execution result, and sends t14, H2(t13), H1(ID), H1(Device), and H(ID+Device).

[0120] h. After the remote device to be controlled receives message f and verifies that H2(t12), H1(ID), H1(Device), and H(ID+Device) are consistent, it decrypts to obtain Command1 and executes the command. After executing the command, it obtains the result out (out includes but is not limited to successful execution, failed execution, and the command does not exist), generates a timestamp t15, and sends t15, H2(t13), H1(ID), H1(Device), H(ID+Device), E(K,out+NUM4+NUM5), and H(out) to the relay server.

[0121] i. The transfer server receives the g message and verifies whether H2(t13), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t16 and sends t16, H2(t14), H1(ID), H1(Device), H(ID+Device), E(K,out+NUM4+NUM5), and H(out) to the device control terminal; it also sends OK to the remote device to be controlled to indicate that the operation result is sent successfully, and sends t16, H2(t15), H1(ID), H1(Device), and H(ID+Device).

[0122] j. The remote device to be controlled receives message i and verifies whether H2(t15), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t17 and sends OK to the relay server, indicating that it is waiting for the next command task, and sends t17, H2(t16), H1(ID), H1(Device), and H(ID+Device).

[0123] k. The device control terminal receives the i message and verifies whether H2(t14), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, the operation result is decrypted. When the next command operation is required, the timestamp t18 and the intended operation command Command2 are generated, and t18, H2(t16), H1(ID), H1(Device), H(ID+Device), E(K, Command2+NUM4+NUM5) are sent to the relay server and the ek operation is repeated; when the next command operation is not required, only the intended execution command Command2 needs to be set to close the service.

[0124] In another optional embodiment of the present invention, when the remote operation of the remote device to be controlled is ended, that is, Command2 is a close command, the following steps are performed:

[0125] 1. After the transit server receives the k message and verifies it successfully, it generates a timestamp t19 and sends t19, H2(t17), H1(ID), H1(Device), H(ID+Device), and E(K, Command2+NUM4+NUM5) to the remote device to be controlled; it also sends OK to the device control terminal to indicate that the transmission is successful, and sends t19, H2(t18), H1(ID), H1(Device), and H(ID+Device).

[0126] m. The remote device to be controlled receives message l and verifies whether H2(t17), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, Command2 is decrypted and the command is executed, which means the service is closed and the connection with the transfer server is disconnected.

[0127] n. The device control terminal receives message l and verifies whether H2(t18), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates timestamp t20, sends OK to the relay server to indicate that it is waiting for the command execution result, and sends t20, H2(t19), H1(ID), H1(Device), and H(ID+Device).

[0128] o. If the relay server fails to receive information from the remote device within the scheduled time, it generates a timestamp t21, sends OK to the device control terminal to indicate that the remote device to be controlled has been disconnected and the service has been closed, and sends t21, H2(t20), H1(ID), H1(Device), and H(ID+Device);

[0129] p. The device control terminal receives the o message and verifies whether H2(t20), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, disconnect the connection with the transit server and terminate the service. The present invention generates a key for the encryption parameters input by the user through the device control terminal to obtain a shared key set. Based on the shared key set, the device control terminal and the remote device to be controlled are negotiated for a shared key. In addition, in the registration and binding stage of the remote device to be controlled and the remote device control stage, the negotiated shared key is used for encryption, thereby improving the security of remote device registration and the confidentiality of control information transmission of the remote device. At the same time, when the remote device to be controlled is registered and bound, it can be deployed using the existing public network, thereby improving the utilization rate of the network, and the preset cloud service platform only registers and binds the device control terminal and the remote device to be controlled, and does not know the negotiated shared key, thereby weakening the authority of the cloud service platform, ensuring that the communication content of both parties cannot be stolen through the cloud service platform, and further improving the security of control information transmission when controlling the remote device. Therefore, the remote device control method proposed in the present invention can improve the security of information transmission during the remote control of the remote device.

[0130] like Figure 2 , which is a functional module diagram of a remote device control apparatus provided by an embodiment of the present invention.

[0131] The remote device control device 100 of the present invention can be installed in an electronic device. According to the functions to be implemented, the remote device control device 100 may include a shared key negotiation module 101, an online device monitoring module 102, and a remote device control module 103. The module of the present invention may also be referred to as a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, and is stored in the memory of the electronic device.

[0132] In this embodiment, the functions of each module / unit are as follows:

[0133] The shared key negotiation module 101 is used to receive encryption parameters input by a user, generate a key according to the encryption parameters, obtain a shared key set, and perform shared key negotiation with a remote device to be controlled by sending the shared key set;

[0134] The device online monitoring module 102 is used to perform online monitoring on the registered and bound remote device to be controlled after the remote device to be controlled is registered on a preset cloud service platform;

[0135] The remote device control module 103 is used to remotely control the online remote device to be controlled based on the negotiated shared key.

[0136] In detail, the specific implementation of each module of the remote device control device 100 is as follows:

[0137] Step 1: The device control terminal receives encryption parameters input by the user, generates a key according to the encryption parameters, obtains a shared key set, and performs shared key negotiation with the remote device to be controlled by sending the shared key set.

[0138] In the embodiment of the present invention, the device control terminal may be a mobile phone, a tablet or a computer. The remote device to be controlled refers to an electronic device that can be remotely controlled and remotely operated by wireless or electrical signals through Internet access and other means, and is mainly used for remote monitoring, remote service, remote diagnosis, etc. At the same time, by setting a shared key, the confidentiality and integrity of data transmission between the two communicating parties can be greatly improved.

[0139] Specifically, the encryption parameters include a symmetric encryption algorithm, an encryption mode, a first hash function, a shared key generation algorithm and an encryption password, and the device control terminal generates a key for the encryption parameters to obtain a shared key set, including:

[0140] The device control terminal generates a shared key using the shared key generation algorithm and the encryption password;

[0141] The device control terminal generates a first negotiated random number, and performs hash processing on the first negotiated random number based on the first hash function to obtain a first negotiated hash value;

[0142] The device control terminal encrypts the shared key and the first negotiated random number using the symmetric encryption algorithm to obtain an encryption key;

[0143] The device control terminal generates a first negotiation timestamp, summarizes the symmetric encryption algorithm, the encryption mode, the first hash function, the first negotiation timestamp, the shared key, the encryption key and the first negotiation hash value, and obtains the shared key set.

[0144] In an optional embodiment of the present invention, the precondition is that the device control terminal and the remote device to be controlled are in the same local area network or are directly physically connected, which can effectively improve the effectiveness of the shared key negotiation.

[0145] In the embodiment of the present invention, the user inputs the symmetric cryptographic algorithm E, the encryption mode M, the first hash function H, the shared key generation algorithm EK, and the encryption password P in the device control terminal, generates the shared key K=EK(P) using the shared key generation algorithm, and generates the first negotiated random number num, encrypts the shared key K and the first negotiated random number num using the symmetric cryptographic algorithm E to obtain the encrypted shared key E(K,num), and hashes the first negotiated random number num using the first hash function H to obtain the first negotiated hash value H(num). At the same time, the shared key set finally generated includes a timestamp, a Nonce (one-time random number) value, etc., which can effectively resist replay attacks and further improve the security of data transmission.

[0146] In detail, the device control terminal performs shared key negotiation with the remote device to be controlled by sending the shared key set, including:

[0147] The device control terminal sends the shared key set to the remote device to be controlled;

[0148] The device control terminal receives a second negotiation timestamp, a second negotiation hash value and a verification key fed back by the remote device to be controlled based on the shared key set;

[0149] The device control terminal performs random number verification and timestamp verification on the second negotiation timestamp, the second negotiation hash value and the verification key;

[0150] When both the random number verification and the timestamp verification are passed, the device control terminal confirms completion of the shared key negotiation with the remote device to be controlled.

[0151] In an optional embodiment of the present invention, when the remote device to be controlled receives the shared key set, it decrypts the encrypted shared key E(K, num), obtains the decrypted random number and performs hash processing, verifies whether it is consistent with the received first negotiated hash value H(num), and when the verification is consistent, verifies whether the first negotiated timestamp T is more than 60s compared with the current time. If it is not more than 60s, it indicates that the timestamp is not invalid, and it is determined that the timestamp verification is successful.

[0152] In an optional embodiment of the present invention, the remote device to be controlled sends a second negotiated timestamp T1, a second negotiated hash value H(num1) and the verification key E(K, num+num1) to the device control terminal, wherein + represents an exclusive OR operation. The steps of performing random number verification and timestamp verification on the second negotiated timestamp, the second negotiated hash value and the verification key by the device control terminal are similar to the steps of verifying the first negotiated hash value and the first negotiated timestamp, and are not repeated here.

[0153] At the same time, when both the random number verification and the timestamp verification are passed, the device control terminal sends a command Command to close the password modification service, that is, E(K, Command) and the second negotiated timestamp T2 are sent to the remote device to be controlled. After receiving the message, the remote device to be controlled closes the password modification service and sends OK to the control software of the remote device to be controlled. After receiving OK, the control software of the remote device to be controlled tries to modify the password again. If there is no response, the service is terminated. If the remote device to be controlled has return information, the status of the remote device to be controlled is checked, the password is modified and the password modification service is closed.

[0154] Step 2: After the remote device to be controlled is registered on the preset cloud service platform, the device control terminal performs online monitoring on the registered and bound remote device to be controlled.

[0155] In the embodiment of the present invention, in view of the high cost of building a private network, low utilization rate, and low cost performance, the present invention adopts the use of the existing public network to operate and control remote devices, which can not only save costs, but also can be used at any time, which is more convenient. In addition, in order to weaken the role authority of the cloud service platform and reduce the impact of attacks on the cloud service platform, the present invention sets the cloud service platform only as an account server and a transit server, wherein the account server mainly stores the user ID and the correspondence between the remote device M, and the transit server is mainly used for the device control terminal and the remote device to perform NAT transmission connection. At the same time, the cloud service platform does not know the shared key K used by the device control terminal to communicate with the remote device, so it can ensure that the communication content of both parties cannot be stolen through the cloud platform, greatly improving security.

[0156] In detail, before the device control terminal performs online monitoring on the registered and bound remote device to be controlled, the method further includes:

[0157] The device control terminal receives the first terminal information input by the user, performs hash processing on the first terminal information, and sends the hashed first terminal information to the account server in the cloud service platform;

[0158] The device control terminal receives the terminal verification information fed back by the account server, wherein the terminal verification information is obtained by the account server verifying the first terminal information after hash processing with the first device information after hash processing obtained from the remote device to be controlled;

[0159] The device control terminal performs terminal verification on the terminal verification information and the first terminal information, and when the terminal verification succeeds, sends second terminal information to the account server;

[0160] The device control terminal receives a registration result fed back by the account server based on the second terminal information and the second device information sent by the remote device to be controlled.

[0161] In an optional embodiment of the present invention, the remote device adding request includes a registration account ID, a registration password P1, a device name Device of the remote device to be controlled. The first verification information includes a second hash function H1, H1(ID), H1(Device) and a first registration random number Num1.

[0162] In an optional embodiment of the present invention, for example, the device control terminal, the account server and the remote device to be controlled are registered and bound using the following steps:

[0163] Step A, the device control terminal receives the first terminal information input by the user: device name Device, account server IP, first registration random number Num1, second hash function H1, the device control terminal generates a first registration timestamp T1, a second registration random number Num2, and then sends the first registration timestamp T1, H1(num1), H1(ID), H1(Device), H(ID+Device), E(K,num2) and H(num2) to the account server;

[0164] Step B, the remote device to be controlled receives the first device information input by the user: the registered account ID, the account server IP, the first registered random number Num1, and the second hash function H1, and the remote device to be controlled generates a second registration timestamp T2 and a third registration random number Num3, and then sends the second registration timestamp T2, H1(num1), H1(ID), H1(Device), H(ID+Device), E(K,num3), and H(num3) to the account server;

[0165] Step C. When the account server receives the messages of step A and step B, it verifies whether H1(num1), H1(ID), H1(Device), and H(ID+Device) are consistent. After verification, it sends terminal verification information to the device control terminal: the third registration timestamp T3, the fourth registration random number Num4, H1(T1), H1(num4+T1), H1(ID), H1(Device), H(ID+Device), E(K,num3), and H(num3); and sends device verification information to the remote device to be controlled: the third registration timestamp T3, the fourth registration random number Num4, H1(T2), H1(num4+T2), H1(ID), H1(Device), H(ID+Device), E(K,num2), and H(num2).

[0166] Step D, the device control terminal receives the information of step C, verifies whether the received H1(T1), H1(ID), H1(Device), H(ID+Device) are consistent with those sent in step A, and calculates H1(num4+T1), verifies whether it is consistent with that received in step C. After successful verification, the second terminal information is sent to the account server: the fourth registration timestamp T4, H1(T3), H1(num4+T3), H1(ID), H1(Device), H(ID+Device), E(K,num2+num3), H(num2+num3);

[0167] Step E: The remote device to be controlled receives the information of step C, verifies whether the received H1(T2), H1(ID), H1(Device), H(ID+Device) are consistent with those sent in step B, and calculates H1(num4+T2) to verify whether it is consistent with that received in step C. After successful verification, the second device information is sent to the account server: the fifth registration timestamp T5, H1(T3), H1(num4+T3), H1(ID), H1(Device), H(ID+Device), E(K,num2+num3), H(num2+num3);

[0168] Step F. After receiving the information from step D and step E, the account server verifies whether H1(T3), H1(num4+T3), H1(ID), H1(Device), H(ID+Device), E(K,num2+num3), and H(num2+num3) in step D and step E are consistent. After verification, the user ID is bound to the remote device to be controlled, and then OK is sent to the remote device to be controlled and the device control terminal respectively. After the remote device to be controlled and the device control terminal receive OK, the service is terminated and the registration and binding is successful.

[0169] In the embodiment of the present invention, for security reasons, the remote device is generally deployed in the intranet and has no public IP address. Therefore, the account server, the device control terminal and the user cannot directly find the remote device through the IP address (generally a private address) of the remote device, nor can they determine whether it is online. The present invention uses heartbeat detection, that is, the remote device periodically sends an online signal to the account server to inform it that it is online.

[0170] In detail, the device control terminal performs online monitoring on the remote device to be controlled after registration and binding, including:

[0171] The device control terminal performs online monitoring of the remote device to be controlled through the remote device IP recorded in the account server.

[0172] In an optional embodiment of the present invention, the remote device to be controlled generates a detection timestamp Ti and sends heartbeat monitoring information to the account server: detection timestamp Ti, H1(Ti+1), H1(ID), H1(Device), H(ID+Device); the account server verifies that the bound device account is correct by checking whether there is a bound device account that satisfies H1(ID), H1(Device), H(ID+Device), and then displays that the remote device to be controlled is online, records the IP, and sends an OK message to the remote device to be controlled. The device control terminal performs online monitoring of the remote device to be controlled through the remote device IP recorded in the account server.

[0173] In another optional embodiment of the present invention, after the remote device to be controlled receives OK, it will wait for the next cycle to send heartbeat monitoring information. If no OK message is received, it will continue to send heartbeat monitoring information. When the number of times the OK message is not received exceeds a preset threshold, an alarm will be issued.

[0174] Step 3: The device control terminal remotely controls the online remote device to be controlled based on the negotiated shared key.

[0175] In an embodiment of the present invention, the control information sent by the device control terminal is encrypted and transmitted based on the negotiated shared key. Due to the confidentiality of the shared key, it can effectively resist control information leakage and replay attacks, thereby greatly reducing the risk of remote devices being attacked and improving the security of remote device use.

[0176] In another optional embodiment of the present invention, before the device control terminal remotely controls the online remote device to be controlled based on the negotiated shared key, the method further includes:

[0177] The device control terminal verifies through the account server whether the remote device to be controlled selected by the user is online;

[0178] If the remote device to be controlled selected by the user is not online, the device control terminal sends an alarm message;

[0179] If the remote device to be controlled selected by the user is online, the device control terminal receives the device online confirmation information sent by the account server.

[0180] In an embodiment of the present invention, a user logs in to an account server and selects the name of a device to be controlled. The account server performs online verification. If the device does not exist or is not online, an alarm notification is sent to the device control terminal. If the device is online, an OK message is sent to the device control terminal.

[0181] In detail, the device control terminal remotely controls the online remote device to be controlled based on the negotiated shared key, including:

[0182] When the device control terminal receives the device online confirmation information sent by the account server, the device control terminal performs two-way authentication with the remote device to be controlled;

[0183] When the two-way authentication is completed, the device control terminal encrypts the sent control information using the negotiated shared key to obtain encrypted control information;

[0184] The device control terminal sends the encrypted control information to the remote device to be controlled, so that the remote device to be controlled decrypts the encrypted control information and executes the decrypted control command.

[0185] In detail, the device control terminal performs two-way authentication with the remote device to be controlled, including:

[0186] The device control terminal performs multiple rounds of random number verification and multiple rounds of timestamp verification with the remote device to be controlled through the account server;

[0187] After the multiple rounds of random number verification and the multiple rounds of timestamp verification are passed, the device control terminal is connected to the remote device to be controlled through a pre-built transit server;

[0188] When the device control terminal detects that the account server receives the confirmation connection message sent by the transit server, the confirmation connection message sent by the device control terminal and the confirmation connection message sent by the remote device to be controlled, it is determined that the two-way authentication is completed.

[0189] In an optional embodiment of the present invention, the two-way authentication between the device control terminal and the remote device to be controlled can be achieved by the following steps:

[0190] Step 1, the device control terminal generates an authentication timestamp t1 and a random number NUM1, and sends the authentication timestamp t1, H1(T0), H1(ID), H1(Device), H(ID+Device), E(K, NUM1), and H(NUM1) to the account server, where T0 is the timestamp when the device is detected to be online;

[0191] Step 2: After receiving the message in step 1, the account server verifies whether the device and account binding information satisfy H1(T0), H1(ID), H1(Device), H(ID+Device). After successful verification, it sends the authentication timestamps t2, H1(t1), H1(ID), H1(Device), H(ID+Device), E(K,NUM1), H(NUM1) to the remote device to be controlled.

[0192] Step 3: The remote device to be controlled receives the message in step 2, verifies whether the received H1(ID), H1(Device), and H(ID+Device) match, and decrypts E(K,NUM1) to calculate H(NUM1), and verifies whether it is consistent with the message received in step 2. After successful verification, it generates the authentication timestamp t3 and random number NUM2, and sends t3, H1(t2), H1(ID), H1(Device), H(ID+Device), E(K,NUM1+NUM2), and H(NUM2+H1(t1)) to the account server;

[0193] Step 4. The account server receives the message from step 3 and verifies whether H1(t2), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it sends authentication timestamps t4, H1(t3), H1(ID), H1(Device), H(ID+Device), E(K, NUM1+NUM2), and H(NUM2+H1(t1)) to the device control terminal; and sends authentication timestamps t4, H1(t3), H1(ID), H1(Device), and H(ID+Device) to the remote device to be controlled;

[0194] Step 5. The device control terminal receives the message of step 4, verifies whether H1(ID), H1(Device), and H(ID+Device) are consistent, and decrypts E(K, NUM1+NUM2) to calculate H(NUM2+H1(t1)), and verifies whether it is consistent with that received in step 4. After successful verification, the authentication timestamp t5, H1(t4), H1(ID), H1(Device), H(ID+Device), and H(E(K, t4)+E(K, NUM1+H1(t3))+E(K, NUM2+H1(t1))) are sent to the account server; the remote device to be controlled sends the authentication timestamp t6, H1(t4), H1(ID), H1(Device), H(ID+Device), and H(E(K, t4)+E(K, NUM1+H1(t3))+E(K, NUM2+H1(t1))) to the account server;

[0195] Step 6. The account server verifies whether H1(t4), H1(ID), H1(Device), H(ID+Device), and H(E(K, t4)+E(K, NUM1+H1(t3))+E(K, NUM2+H1(t1))) sent by both parties in step 5 are consistent. After verifying H1(t4), the account server generates an authentication timestamp t7 and a random number NUM3, selects a transit server IP and a forwarding port Port, and sends t7, NUM3, H1(ID), H1(Device), H(ID+Device), hash function H2, transit server IP and Port to the device control terminal and the remote device to be controlled respectively; and sends t7, NUM3, H1(ID), H1(Device), H(ID+Device), hash function H2 and forwarding Port to the transit server;

[0196] Step 7: After receiving the message in step 6, the transit server stores NUM3, H1(ID), H1(Device), H(ID+Device), opens the forwarding port and service, and sends an OK message to the account server;

[0197] Step 8: After receiving the message in step 6, the device control terminal and the remote device to be controlled confirm that they can connect to the transit server and then send an OK message to the account server. After the account server receives the OK message from all three parties, the authentication process ends.

[0198] In an optional embodiment of the present invention, after the device control terminal and the remote device to be controlled obtain the IP and forwarding port of the transit server, a shared key is used to perform the control information encryption transmission stage. The specific steps are as follows:

[0199] a. The device control terminal generates a timestamp t8 and a random number NUM4, and sends t8, H2(NUM3), H1(ID), H1(Device), H(ID+Device), H2(E(K,NUM3)), E(K,NUM4), and H(NUM4) to the relay server.

[0200] b. The remote device to be controlled generates a timestamp t9 and a random number NUM5, and sends t9, H2(NUM3), H1(ID), H1(Device), H(ID+Device), H2(E(K,NUM3)), E(K,NUM5), and H(NUM5) to the relay server.

[0201] c. After receiving messages a and b, the relay server verifies whether H2(NUM3), H1(ID), H1(Device), H(ID+Device), and H2(E(K,NUM3)) are consistent. After successful verification, it sends OK to the device control terminal to indicate that the command can be sent, and sends t10, H2(t8), H1(ID), H1(Device), H(ID+Device), E(K,NUM5), and H(NUM5); it sends OK to the remote device to be controlled to indicate that the command is ready to be sent, and sends t10, H2(t9), H1(ID), H1(Device), H(ID+Device), E(K,NUM4), and H(NUM4).

[0202] d. After receiving message c, the remote device to be controlled verifies whether H2(t8), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t11 and sends t11, H2(t10), H1(ID), H1(Device), and H(ID+Device) to the relay server, indicating that it is waiting to receive a command.

[0203] e. After receiving OK, the device control terminal generates timestamp t12, intends to execute command Command1, and sends t12, H2(t10), H1(ID), H1(Device), H(ID+Device), and E(K, Command1+NUM4+NUM5) to the transit server.

[0204] f. After receiving messages d and e, the relay server verifies whether H2(t10), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t13 and sends t13, H2(t12), H1(ID), H1(Device), H(ID+Device), and E(K, Command1+NUM4+NUM5) to the remote device to be controlled; after the transmission is completed, it sends OK to the device control terminal to indicate that the command has been sent successfully, and sends t13, H2(t11), H1(ID), H1(Device), and H(ID+Device).

[0205] g. The device control terminal receives message f and verifies whether H2(t11), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates timestamp t14, sends OK to the relay server to indicate that it is waiting for the command execution result, and sends t14, H2(t13), H1(ID), H1(Device), and H(ID+Device).

[0206] h. After the remote device to be controlled receives message f and verifies that H2(t12), H1(ID), H1(Device), and H(ID+Device) are consistent, it decrypts to obtain Command1 and executes the command. After executing the command, it obtains the result out (out includes but is not limited to successful execution, failed execution, and the command does not exist), generates a timestamp t15, and sends t15, H2(t13), H1(ID), H1(Device), H(ID+Device), E(K,out+NUM4+NUM5), and H(out) to the relay server.

[0207] i. The transfer server receives the g message and verifies whether H2(t13), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t16 and sends t16, H2(t14), H1(ID), H1(Device), H(ID+Device), E(K,out+NUM4+NUM5), and H(out) to the device control terminal; it also sends OK to the remote device to be controlled to indicate that the operation result is sent successfully, and sends t16, H2(t15), H1(ID), H1(Device), and H(ID+Device).

[0208] j. The remote device to be controlled receives message i and verifies whether H2(t15), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates a timestamp t17 and sends OK to the relay server, indicating that it is waiting for the next command task, and sends t17, H2(t16), H1(ID), H1(Device), and H(ID+Device).

[0209] k. The device control terminal receives the i message and verifies whether H2(t14), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, the operation result is decrypted. When the next command operation is required, the timestamp t18 and the intended operation command Command2 are generated, and t18, H2(t16), H1(ID), H1(Device), H(ID+Device), E(K, Command2+NUM4+NUM5) are sent to the relay server and the ek operation is repeated; when the next command operation is not required, only the intended execution command Command2 needs to be set to close the service.

[0210] In another optional embodiment of the present invention, when the remote operation of the remote device to be controlled is ended, that is, Command2 is a close command, the following steps are performed:

[0211] 1. After the transit server receives the k message and verifies it successfully, it generates a timestamp t19 and sends t19, H2(t17), H1(ID), H1(Device), H(ID+Device), and E(K, Command2+NUM4+NUM5) to the remote device to be controlled; it also sends OK to the device control terminal to indicate that the transmission is successful, and sends t19, H2(t18), H1(ID), H1(Device), and H(ID+Device).

[0212] m. The remote device to be controlled receives message l and verifies whether H2(t17), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, Command2 is decrypted and the command is executed, which means the service is closed and the connection with the transfer server is disconnected.

[0213] n. The device control terminal receives message l and verifies whether H2(t18), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, it generates timestamp t20, sends OK to the relay server to indicate that it is waiting for the command execution result, and sends t20, H2(t19), H1(ID), H1(Device), and H(ID+Device).

[0214] o. If the relay server fails to receive information from the remote device within the scheduled time, it generates a timestamp t21, sends OK to the device control terminal to indicate that the remote device to be controlled has been disconnected and the service has been closed, and sends t21, H2(t20), H1(ID), H1(Device), and H(ID+Device);

[0215] p. The device control terminal receives the o message and verifies whether H2(t20), H1(ID), H1(Device), and H(ID+Device) are consistent. After successful verification, the connection with the transfer server is disconnected and the service is terminated.

[0216] The present invention generates a key for the encryption parameters input by the user through the device control terminal to obtain a shared key set. Based on the shared key set, the device control terminal and the remote device to be controlled are negotiated for a shared key. In addition, the negotiated shared key is used for encryption in the registration and binding stage of the remote device to be controlled and the remote device control stage, thereby improving the security of remote device registration and the confidentiality of control information transmission of the remote device. At the same time, when the remote device to be controlled is registered and bound, it can be deployed using an existing public network, thereby improving the utilization rate of the network, and the preset cloud service platform only registers and binds the device control terminal and the remote device to be controlled, and does not know the negotiated shared key, thereby weakening the authority of the cloud service platform, ensuring that the communication content of the two parties cannot be stolen through the cloud service platform, and further improving the security of control information transmission when controlling the remote device. Therefore, the remote device control method proposed in the present invention can improve the security of information transmission during remote control of remote devices.

[0217] like Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device for implementing a remote device control method provided by an embodiment of the present invention.

[0218] The electronic device may include a processor 10 , a memory 11 , a communication interface 12 , and a bus 13 , and may also include a computer program stored in the memory 11 and executable on the processor 10 , such as a remote device control program.

[0219] Wherein, the memory 11 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory 11 can also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 11 can also include both an internal storage unit of the electronic device and an external storage device. The memory 11 can not only be used to store application software and various types of data installed in the electronic device, such as the code of the remote device control program, etc., but also can be used to temporarily store data that has been output or is to be output.

[0220] The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The processor 10 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes or executes programs or modules (such as remote device control programs, etc.) stored in the memory 11, and calls data stored in the memory 11 to execute various functions of the electronic device and process data.

[0221] The communication interface 12 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0222] The bus 13 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 13 may be divided into an address bus, a data bus, a control bus, etc. The bus 13 is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0223] Figure 3 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0224] For example, although not shown, the electronic device may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to the at least one processor 10 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0225] Furthermore, the electronic device may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices.

[0226] Optionally, the electronic device may further include a user interface, which may be a display, an input unit (such as a keyboard), or a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0227] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0228] The remote device control program stored in the memory 11 in the electronic device is a combination of multiple instructions. When running in the processor 10, it can achieve:

[0229] Receiving encryption parameters input by a user, generating a key according to the encryption parameters, obtaining a shared key set, and performing shared key negotiation with a remote device to be controlled by sending the shared key set;

[0230] After the remote device to be controlled is registered on the preset cloud service platform, online monitoring is performed on the registered and bound remote device to be controlled;

[0231] The online remote device to be controlled is remotely controlled based on the negotiated shared key.

[0232] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to Figure 1 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0233] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0234] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the computer program can implement:

[0235] Receiving encryption parameters input by a user, generating a key according to the encryption parameters, obtaining a shared key set, and performing shared key negotiation with a remote device to be controlled by sending the shared key set;

[0236] After the remote device to be controlled is registered on the preset cloud service platform, online monitoring is performed on the registered and bound remote device to be controlled;

[0237] The online remote device to be controlled is remotely controlled based on the negotiated shared key.

[0238] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0239] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0240] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0241] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0242] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0243] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the system claim can also be implemented by one unit or device through software or hardware. The second and other words are used to indicate names, but not to indicate any particular order.

[0244] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A remote device control method, characterized in that: The method is applied to a device control terminal, comprising: Receiving encryption parameters input by a user, generating a key according to the encryption parameters, obtaining a shared key set, and performing shared key negotiation with a remote device to be controlled by sending the shared key set; After the remote device to be controlled is registered on the preset cloud service platform, online monitoring is performed on the registered and bound remote device to be controlled; Based on the negotiated shared key, remote control is performed on the online monitored remote device to be controlled; The encryption parameters include a symmetric encryption algorithm, an encryption mode, a first hash function, a shared key generation algorithm, and an encryption password. The key is generated according to the encryption parameters to obtain a shared key set, including: Generate a shared key using the shared key generation algorithm and the encryption password; Generate a first negotiated random number, and perform hash processing on the first negotiated random number based on the first hash function to obtain a first negotiated hash value; Encrypting the shared key and the first negotiated random number using the symmetric encryption algorithm to obtain an encryption key; Generate a first negotiation timestamp, summarize the symmetric cryptographic algorithm, the encryption mode, the first hash function, the first negotiation timestamp, the shared key, the encryption key and the first negotiated hash value, and obtain the shared key set; The step of performing shared key negotiation with the remote device to be controlled by sending the shared key set includes: Sending the shared key set to the remote device to be controlled; Receive a second negotiation timestamp, a second negotiation hash value, and a verification key fed back by the remote device to be controlled based on the shared key set; Performing random number verification and timestamp verification on the second negotiation timestamp, the second negotiation hash value and the verification key; When both the random number verification and the timestamp verification are passed, confirming completion of the shared key negotiation with the remote device to be controlled; The verification key is obtained by encrypting the shared key and a random number using the symmetric encryption algorithm, and the random number is obtained by performing an XOR operation on the first negotiated random number and the second negotiated random number; Among them, when verifying the verification key, the verification key is decrypted to obtain a verification key decrypted random number, and the inverse operation of the XOR operation is performed on the verification key decrypted random number, and based on the first negotiated random number, the decrypted second negotiated random number is separated from the inverse operation result of the XOR operation, and the decrypted second negotiated random number is hashed to verify whether it is consistent with the received second negotiated hash value.

2. The remote device control method according to claim 1, characterized in that: Before performing online monitoring on the registered and bound remote device to be controlled, the method further includes: Receiving first terminal information input by a user, performing hash processing on the first terminal information, and sending the hashed first terminal information to an account server in the cloud service platform; Receiving terminal verification information fed back by the account server, wherein the terminal verification information is obtained by the account server verifying the hashed first terminal information with the hashed first device information obtained from the remote device to be controlled; Performing terminal verification on the terminal verification information and the first terminal information, and when the terminal verification succeeds, sending second terminal information to the account server; Receive a registration result fed back by the account server based on the second terminal information and the second device information sent by the remote device to be controlled.

3. The remote device control method according to claim 2, characterized in that: The method of remotely controlling the online remote device to be controlled based on the negotiated shared key includes: When receiving the device online confirmation information sent by the account server, performing two-way authentication with the remote device to be controlled; When the two-way authentication is completed, the sent control information is encrypted using the negotiated shared key to obtain encrypted control information; The encrypted control information is sent to the remote device to be controlled, so that the remote device to be controlled decrypts the encrypted control information and executes the decrypted control command.

4. The remote device control method according to claim 3, characterized in that: The performing two-way authentication with the remote device to be controlled includes: Perform multiple rounds of random number verification and multiple rounds of timestamp verification with the account server and the remote device to be controlled; After the multiple rounds of random number verification and the multiple rounds of timestamp verification are passed, a transit connection is established with the remote device to be controlled through a pre-built transit server; When it is monitored that the account server receives the connection confirmation message sent by the transit server, the connection confirmation message sent by the device control terminal, and the connection confirmation message sent by the remote device to be controlled, it is determined that the two-way authentication is completed.

5. The remote device control method according to claim 2, characterized in that: The online monitoring of the remote device to be controlled after registration and binding includes: The remote device to be controlled is monitored online through the remote device IP recorded in the account server.

6. A remote device control device, characterized in that: The device comprises: A shared key negotiation module, used to receive encryption parameters input by a user, generate a key according to the encryption parameters, obtain a shared key set, and perform shared key negotiation with a remote device to be controlled by sending the shared key set; The device online monitoring module is used to perform online monitoring on the remote device to be controlled after the remote device to be controlled is registered and bound on the preset cloud service platform; A remote device control module, used for remotely controlling the online remote device to be controlled based on the negotiated shared key; The encryption parameters include a symmetric encryption algorithm, an encryption mode, a first hash function, a shared key generation algorithm, and an encryption password. The device control terminal generates a key for the encryption parameters to obtain a shared key set, including: The device control terminal generates a shared key using the shared key generation algorithm and the encryption password; The device control terminal generates a first negotiated random number, and performs hash processing on the first negotiated random number based on the first hash function to obtain a first negotiated hash value; The device control terminal encrypts the shared key and the first negotiated random number using the symmetric encryption algorithm to obtain an encryption key; The device control terminal generates a first negotiation timestamp, summarizes the symmetric cryptographic algorithm, the encryption mode, the first hash function, the first negotiation timestamp, the shared key, the encryption key and the first negotiation hash value, and obtains the shared key set; The device control terminal performs shared key negotiation with the remote device to be controlled by sending the shared key set, including: The device control terminal sends the shared key set to the remote device to be controlled; The device control terminal receives a second negotiation timestamp, a second negotiation hash value and a verification key fed back by the remote device to be controlled based on the shared key set; The device control terminal performs random number verification and timestamp verification on the second negotiation timestamp, the second negotiation hash value and the verification key; When both the random number verification and the timestamp verification are passed, the device control terminal confirms completion of the shared key negotiation with the remote device to be controlled; The verification key is obtained by encrypting the shared key and a random number using the symmetric encryption algorithm, and the random number is obtained by performing an XOR operation on the first negotiated random number and the second negotiated random number; Among them, when verifying the verification key, the verification key is decrypted to obtain a verification key decrypted random number, and the inverse operation of the XOR operation is performed on the verification key decrypted random number, and based on the first negotiated random number, the decrypted second negotiated random number is separated from the inverse operation result of the XOR operation, and the decrypted second negotiated random number is hashed to verify whether it is consistent with the received second negotiated hash value.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the remote device control method according to any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the remote device control method according to any one of claims 1 to 5 is implemented.

Images